buffer: UTF-16LE indexOf can hang on unaligned Buffer views

[inoway46]

Version

v27.0.0-pre (b805fb5158a)

Platform

Darwin 24.6.0 arm64

Subsystem

buffer

What steps will reproduce the bug?

Buffer#indexOf() can hang when its receiver is an unaligned view. The child process timeout prevents the reproduction from hanging indefinitely.

'use strict';

const { spawnSync } = require('node:child_process');

for (const prefixLength of [0, 1]) {
  const source = `
    const data = Buffer.from('abc', 'utf16le');
    const backing = Buffer.alloc(data.length + ${prefixLength});
    data.copy(backing, ${prefixLength});

    const view = backing.subarray(${prefixLength});
    console.log(view.indexOf('a', 0, 'utf16le'));
  `;

  const result = spawnSync(process.execPath, ['-e', source], {
    encoding: 'utf8',
    timeout: 2000,
  });

  console.log({
    prefixLength,
    status: result.status,
    error: result.error?.code,
    stdout: result.stdout.trim(),
  });
}

How often does it reproduce? Is there a required condition?

It's consistent when the receiver view starts at an odd byte offset. The aligned control returns normally.

What is the expected behavior? Why is that the expected behavior?

Both searches should terminate and return 0.
The views contain the same bytes, and the UTF-16LE value begins at index 0 of each view. The result should not depend on the underlying memory address.

What do you see instead?

The aligned view returns 0. The view starting at byte offset 1 does not complete before the timeout:

{ prefixLength: 0, status: 0, error: undefined, stdout: '0' }
{ prefixLength: 1, status: null, error: 'ETIMEDOUT', stdout: '' }

Additional information

Buffer#indexOf() passes the receiver data to the 16-bit search, while nbytes aligns matched addresses down. For an odd-offset view, this can move before the start of the view and appears to cause the hang.

This is distinct from #26448, which concerns search-offset rounding, and remains reproducible after #65905, which affects UTF-16LE decoding rather than Buffer#indexOf().

Copying the view or using a Buffer needle avoids the hang. Both workarounds return 0 locally:

Buffer.from(view).indexOf('a', 0, 'utf16le');
view.indexOf(Buffer.from('a', 'utf16le'));

[bitpshr]

Reproduced on macOS arm64, both v22 and current main. Even byte offsets are fine, odd ones hang, whatever the needle is. Opened #65968.

Root cause is the UCS2 paths reinterpreting the view pointer as uint16_t without checking alignment, so an odd offset view reads through a misaligned pointer.

A few things it reaches beyond your reproduction, in case they are useful:

• includes() hangs the same way, it goes through the same path
• the Buffer needle form hangs too, that is a separate function (IndexOfBuffer), and its needle can be an unaligned view as well
• lastIndexOf() does not hang, it quietly returns -1 for a needle that is there, which seems worse than the hang since nothing tells you

Also worth flagging that #65960 is open against this issue but fixes a different problem, an odd offset argument rather than an unaligned view. Both are real, they just do not overlap. Your reproduction passes an offset of 0, so it needs the alignment fix.